using a hex editor to edit an image we can actually use hex editors to change image files usually,...
Post on 20-Dec-2015
221 views
TRANSCRIPT
![Page 1: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/1.jpg)
Using a hex editor to edit an image
• We can actually use hex editors to change image files
• Usually, we will use programs like PhotoPlus or PhotoShop
• But if you use a hex editor, you will appreciate the fundamental details of how images are stored in files
• We will change test.bmp using XVI32
• First, however, we must learn some details of the .bmp format
![Page 2: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/2.jpg)
The .bmp format
• A file in the Microsoft .bmp format can also be known as a .dib file
• A detailed description can be found here http://www.cs.ucc.ie/j.bowen/cs1107/imageFormats/bmp/bitmapStorage.html
and
http://www.cs.ucc.ie/j.bowen/cs1107/imageFormats/bmp/formatDesc.html
• The first of these is a local copy of this Microsoft page:
http://msdn.microsoft.com/en-us/library/dd183391(v=VS.85).aspx
![Page 3: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/3.jpg)
The .bmp format• A .bmp file file has four sections• The File Header contains
general details about the file• The Info Header contains
general details about the image in the file
• The Colour Table describes the palette of colours used in the image
• The Pixel Data specifies the contents of the dots in the picture by specifying, for each pixel, which colour in the palette is used in the pixel
![Page 4: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/4.jpg)
The .bmp format
![Page 5: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/5.jpg)
File test.bmp
![Page 6: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/6.jpg)
File test.bmp
![Page 7: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/7.jpg)
File test.bmp
• The first two bytes of the File Header contain the ASCII codes for BM, as specified
![Page 8: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/8.jpg)
File test.bmp• Bytes three to six of
the File Header contain
46 04 00 00hex
• This number is in little-endian format, so it is really
00 00 04 46hex
• This is equal to 1094dec
• We saw earlier that this is, indeed, the size of the file
![Page 9: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/9.jpg)
File test.bmp• Bytes eleven to fourteen
of the File Header contain
36 04 00 00hex
• This number is in little-endian format, so it is really
00 00 04 36hex
![Page 10: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/10.jpg)
File test.bmp• Bytes eleven to fourteen
of the File Header contain
36 04 00 00hex
• This number is in little-endian format, so it is really
00 00 04 36hex
• This number points to the start of the pixel data in the file
![Page 11: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/11.jpg)
File test.bmp• Bytes one to four of the
Info Header contain
28 00 00 00hex
• This number is in little-endian format, so it is really
00 00 00 28hex
• As the format specifies, this is equal to 40dec
![Page 12: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/12.jpg)
File test.bmp• Bytes five to eight of
the Info Header contain
04 00 00 00hex
• This number is in little-endian format, so it is really
00 00 00 04hex
• This is, indeed, equal to the width of the picture in test.bmp, which is 4px wide by 4 px high
![Page 13: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/13.jpg)
File test.bmp• Bytes nine to twelve of
the Info Header contain
04 00 00 00hex
• This number is in little-endian format, so it is really
00 00 00 04hex
• This is, indeed, equal to the height of the picture in test.bmp, which is 4px wide by 4 px high
![Page 14: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/14.jpg)
File test.bmp• Bytes thirteen to
fourteen of the Info Header contain
01 00hex
• This number is in little-endian format, so it is really
00 01hex
• This is, indeed, equal to the number 1 which is specified in the format
![Page 15: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/15.jpg)
File test.bmp• Bytes fifteen to sixteen
of the Info Header contain
08 00hex
• This number is in little-endian format, so it is really
00 08hex
• So 8 bits are used to represent each pixel, allowing for a palette which contains 256 different colours
• Even though only 2 colours are used in the picture
![Page 16: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/16.jpg)
File test.bmp• Bytes seventeen to
twenty of the Info Header contain
00 00hex
• So the picture is not compressed
![Page 17: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/17.jpg)
File test.bmp• Bytes twenty-one to
twenty-four of the Info Header contain
10 00 00 00hex
• This number is in little-endian format, so it is really
00 00 00 10hex
• Since the image is not compressed, this value seems to be irrelevant
![Page 18: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/18.jpg)
File test.bmp• Bytes twenty-five to
twenty-eight of the Info Header contain
12 0B 00 00hex
• This number is in little-endian format, so it is really
00 00 0B 12hex
• This specifies 2834dec pixels per metre horizontally
![Page 19: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/19.jpg)
File test.bmp• Bytes twenty-five to
twenty-eight of the Info Header contain
12 0B 00 00hex
• This number is in little-endian format, so it is really
00 00 0B 12hex
• This specifies 2834dec pixels per metre horizontally
• This agrees with the fact that PhotoPlus says that 4 pixels equals 0.141 centimetres
![Page 20: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/20.jpg)
File test.bmp• Similarly, bytes twenty-
nine to thirty-two of the Info Header contain
12 0B 00 00hex
• This number is in little-endian format, so it is really
00 00 0B 12hex
• Again, this specifies 2834dec pixels per metre horizontally
• Which agrees with the fact that PhotoPlus says that 4 pixels equals 0.141 centimetres
![Page 21: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/21.jpg)
File test.bmp• Bytes thirty-three to
thirty-six of the Info Header contain
00 01 00 00hex
• Since this is in little-endian, it is really
00 00 01 00hex
• This means that there are 256dec colours in the palette
![Page 22: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/22.jpg)
File test.bmp• Bytes thirty-three to
thirty-six of the Info Header contain
00 01 00 00hex
• Since this is in little-endian, it is really
00 00 01 00hex
• This means that there are 256dec colours in the palette
• Since there are 4 bytes per colour, the palette should occupy 04 00hex bytes
• Which it does, ranging from 0036 to 0435
![Page 23: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/23.jpg)
File test.bmp• Bytes thirty-seven to
forty of the Info Header contain
02 00 00 00hex
• Since this is in little-endian, it is really
00 00 00 02hex
• This means that there are only 2 important colours in the palette
• Which agrees with what we know -- the picture contains only blue and red pixels
![Page 24: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/24.jpg)
File test.bmp• Bytes one to four of Colour
Table are
00 00 FF 00 • The fourth byte is unused
00 00 FF 00, so ignore it • Since the three bytes
00 00 FF are little-endian, they are really
FF 00 00• These represent proportions
of RGB (Red, Green, Blue)• Thus, the first colour in the
palette consists of 255red 0green 0blue
• That is, the first colour in the palette is pure red
![Page 25: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/25.jpg)
File test.bmp• Bytes five to eight of the
Colour Table contain
FF 00 00 00 • Since the three bytes
FF 00 00 are little-endian, they are really 00 00 FF
• Thus, the second colour in the palette consists of 0red 0green 255blue
• That is, the first colour in the palette is pure blue
![Page 26: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/26.jpg)
File test.bmp• Before we look at the
pixel data in the file, let's look at the image and zoom in to see it clearly
![Page 27: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/27.jpg)
File test.bmp• In the Pixel Data, the
bottom row is stored first, the pixel details being given in the order left-to-right
• These four pixels are specified to use colour 01 in the colour table, that is the second colour, that is pure blue
![Page 28: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/28.jpg)
File test.bmp• The second row from the
bottom is stored next, the pixels again in left-to-right order
• These four pixels are specified to use colour 00 in the colour table, that is the first colour, that is pure red
![Page 29: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/29.jpg)
File test.bmp• The third row from the
bottom is stored next, the pixels again in left-to-right order
• These four pixels are specified to use colour 01 in the colour table, that is the second colour, that is pure blue
![Page 30: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/30.jpg)
File test.bmp• The top row is stored
last, the pixels again in left-to-right order
• These four pixels are specified to use colour 00 in the colour table, that is the first colour, that is pure red
![Page 31: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/31.jpg)
Changing test.bmp• Let's use XVI32 to
change the last byte in the file, changing it from 00 to 01
• This byte represents the right-most pixel in the top row of the picture
• We have changed its value, making it refer to the second colour in the Colour Table, which is pure blue
• Let's store the modified picture in a file called test2.bmp
![Page 32: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/32.jpg)
File test2.bmp• When we open
test2.bmp in PhotoPlus, we see that we have, indeed, made the change we intended
• The right-most pixel in the top row of the picture has been changed to blue
![Page 33: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/33.jpg)
Storing the test.bmp image more efficiently• Re-open the original test.bmp• We can store its image more efficiently, by reducing the Colour
Table to contain just the two colours that are used• If we use XVI32 to make the appropriate changes, we get the bytes
shown below -- now only 78dec bytes are needed
• Let's store the modified data in a file called test3.bmp
![Page 34: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/34.jpg)
Viewing image in test3.bmp• When we open test3.bmp in PhotoPlus, we see that the image in
the 78-byte file looks exactly like the image in the 1094-byte file
![Page 35: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/35.jpg)
Changing the aspect ratio of the image• We can easily convert the image in test3.bmp into an 8-by-2 image
instead of a 4-by-4. because both images contain 16 bytes• In XVI32, we need change only the two bytes highlighted below• Let's store the modified data in a file called test4.bmp
![Page 36: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/36.jpg)
Viewing image in test4.bmp• The image has two rows, each eight pixels long
![Page 37: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/37.jpg)
Lines must be padded out to multiples of 4 bytes• Below is a file containing a 5-by-3 image, a 15-pixel image
• Although the image has one pixel less than the previous image, the file is larger - it contains 86 bytes instead of 78
• This is because, although each line has only 5 pixels, each line must be padded out to a multiple of 4 bytes, so 8 bytes are needed for each line
• Below, the padding bytes are coloured light blue - zeros are used for padding here, but it appears that the padding can be anything
• Let's store this 15-pixel image in a file called test15d.bmp
![Page 38: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/38.jpg)
Viewing image in test15d.bmp• The image has three rows, each five pixels long• As we see on next slide, the pixels are as we would predict from XVI32
![Page 39: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/39.jpg)
Viewing image in test15d.bmp• The pixels are as we would predict from XVI32
– Remember that the pixels of the top row appear last in the file
– Remember that colours are represented as Blue-Green-Red-unused
![Page 40: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/40.jpg)
A bug in PhotoPlus
• As we shall see later, there is a bug in the way that PhotoPlus handles .bmp files
• So, first, let's check that the view which PhotoPlus gives of the image in test15d.bmp is correct
• We will look at the image in another image editor and in some browsers
![Page 41: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/41.jpg)
Viewing image in test15d.bmp in MS Paint• The View menu has been tuned to 800% so that we can see detail• The image looks the same as we expect
![Page 42: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/42.jpg)
Viewing image in test15d.bmp in Firefox• The View menu has been used to zoom in so that we can see detail• The image looks the same as we expect
![Page 43: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/43.jpg)
Viewing image in test15d.bmp in Opera• The View menu has been used to zoom in so that we can see detail• The image looks the same as we expect
![Page 44: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/44.jpg)
Viewing image in test15d.bmp in MSIE• Internet Explorer does not display .bmp files itself • Instead, it calls MS Paint as a helper program• As we have already seen, in MS Paint the image looks as expected
![Page 45: Using a hex editor to edit an image We can actually use hex editors to change image files Usually, we will use programs like PhotoPlus or PhotoShop But](https://reader030.vdocument.in/reader030/viewer/2022032800/56649d4c5503460f94a29ac6/html5/thumbnails/45.jpg)
Absolutely basic 8-bit depth .bmp format• We have seen that the common image display programs ignore much of the format for 8-bit-
depth .bmp files• The minimum we must do when making an 8-bit depth file is
– assign the fixed values shown below to the bytes marked green
– put the image width and depth in bytes 12-15hex and 16-19hex, respectively
– specify the number of colours in bytes 2E-31hex
– specify the colours in 4-byte blocks from byte 36hex onwards (two colours are shown in the example below)
– specify the pixels immediately afterwards, padding the lines if necessary (16 pixels are shown in the example below)
– put the address of the first pixel specification in bytes 0A-0Dhex
– put the overall file size in bytes 02-05hex